# Copyright (c) 2014 Flowerfire, Inc. All Rights Reserved. fsecure_http_access = { plugin_version = "1.0" info.1.manufacturer = "F-Secure" info.1.device = "HTTP Access" info.1.version.1 = "" # 2014-03-03 - 1.0 - GMF - Initial creation # The name of the log format log.format.format_label = "F-Secure HTTP Access" log.miscellaneous.log_data_type = "firewall" log.miscellaneous.log_format_type = "proxy_server" # The log is in this format if any of the first ten lines match this regular expression #2014-03-01 22:51:06 : 1393681866.891 36 12.34.56.78 TCP_MISS/200 157 GET http://somewhere.com/index.html - DIRECT/23.45.67.89 text/javascript DETECT-STAT:CLEAN::::: ACTION:NONE: PROXY-STAT:http:1:4804:172.18.3.51:1:1:13:: PROTOCOL-STAT::: PROXY-ERROR:: log.format.autodetect_regular_expression = "^[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9] : [0-9]+[.][0-9][0-9][0-9] +[0-9]+ [0-9.a-f:]+ " log.format.parse_only_with_filters = "true" # Log fields log.fields = { date = "" time = "" timestamp = "" source_port = "" source_ip = "" bytes = "" operation = "" url = "" unknown = "" hierarchy = "" mime_type = "" detect_stat = "" action = "" proxy_stat = "" protocol_stat = "" proxy_error = "" # accesses = "" } # log.fields log.parsing_filters.parse = ` if (matches_regular_expression(current_log_line(), "^([0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]) ([0-9][0-9]:[0-9][0-9]:[0-9][0-9]) : ([0-9]+[.][0-9][0-9][0-9]) +([0-9]+) ([0-9.a-f:]+) ([^ ]+) ([0-9]+) ([^ ]+) ([^ ]+) ([^ ]+) ([^ ]+) ([^ ]+) ([^ ]+) ([^ ]+) ([^ ]+) ([^ ]+)")) then ( set_collected_field('', 'date', $1); set_collected_field('', 'time', $2); set_collected_field('', 'timestamp', $3); set_collected_field('', 'source_port', $4); set_collected_field('', 'source_ip', $5); # set_collected_field('', '', $6); set_collected_field('', 'bytes', $7); set_collected_field('', 'operation', $8); set_collected_field('', 'url', $9); # set_collected_field('', '', $10); set_collected_field('', 'hierarchy', $11); set_collected_field('', 'mime_type', $12); set_collected_field('', 'detect_stat', $13); set_collected_field('', 'action', $14); set_collected_field('', 'proxy_stat', $15); set_collected_field('', 'protocol_stat', $16); set_collected_field('', 'proxy_error', $17); accept_collected_entry('', false); ); ` # Database fields database.fields = { date_time = "" day_of_week = "" hour_of_day = "" source_port = "" source_ip = "" operation = "" url = "" hierarchy = "" mime_type = "" # detect_stat = "" # action = "" # proxy_stat = "" # protoco_stat = "" } # database.fields database.numerical_fields = { # accesses = { ## default = true # entries_field = true # } # accesses bytes = { integer_bits = 64 display_format_type = "bandwidth" } # bytes } # database.numerical_fields create_profile_wizard_options = { # How the reports should be grouped in the report menu report_groups = { date_time_group = "" } # report_groups snapons = { # Attach proxy_direction, to prompt for whether this is a forward or reverse proxy # proxy_direction = { # snapon = "proxy_direction" # name = "proxy_direction" # label = "$lang_admin.snapons.proxy_direction.label" # parameters = { # proxy_direction.parameter_value = "" # source_ip_field.parameter_value = "source_ip" # server_ip_field.parameter_value = "server_ip" # } # parameters # # parameters_form = { # group_1 = { # description = "$lang_admin.snapons.proxy_direction.parameters_form.group_1.description" # parameters = { # proxy_direction = true # } # parameters # } # group 1 # } # parameters_form # # } # proxy_direction # Attach a gateway_reports snapon gateway_reports = { snapon = "gateway_reports" name = "gateway_reports" label = "$lang_admin.snapons.gateway_reports.label" parameters = { user_field.parameter_value = "source_ip" have_category_field.parameter_value = false # category_field.parameter_value = "category" host_field.parameter_value = "top_level_domain" url_field.parameter_value = "url" page_views_field.parameter_value = "accesses" bytes_in_field.parameter_value = "bytes" sort_by_field.parameter_value = "accesses" accesses_field.parameter_value = "Accesses" accesses_field = { parameter_value = "$lang_stats.field_labels.accesses" final_node_name = "accesses" } # accesses } # parameters } # gateway_reports # 2013-02-06 - GMF - Now added in gateway_reports # # Add the standard reports # add_standard_reports = { # name = "add_standard_reports" # label = "add_standard_reports" # snapon = "add_standard_reports" # } # add_standard_reports } # snapons } # create_profile_wizard_options } # fsecure_http_access